feat: implement composite API key scopes for workspaces and templates (#19945)

# Add Composite API Key Scopes

This PR adds high-level composite API key scopes to simplify token creation with common permission sets:

- `coder:workspaces.create` - Create and update workspaces
- `coder:workspaces.operate` - Read and update workspaces
- `coder:workspaces.delete` - Read and delete workspaces
- `coder:workspaces.access` - Read, SSH, and connect to workspace applications
- `coder:templates.build` - Read templates and create/read files
- `coder:templates.author` - Full template management with insights
- `coder:apikeys.manage_self` - Manage your own API keys

These composite scopes are persisted in the database and expanded during authorization, providing a more intuitive way to grant permissions compared to the granular resource:action scopes.

coderd/database/migrations/000375_add_composite_api_key_scopes.down.sql

@@ -0,0 +1,3 @@
+-- No-op: keep enum values to avoid dependency churn.
+-- If strict removal is required, create a new enum type without these values,
+-- cast columns, drop the old type, and rename.

coderd/database/migrations/000375_add_composite_api_key_scopes.up.sql

@@ -0,0 +1,9 @@
+-- Add high-level composite coder:* API key scopes
+-- These values are persisted so that tokens can store coder:* names directly.
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'coder:workspaces.create';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'coder:workspaces.operate';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'coder:workspaces.delete';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'coder:workspaces.access';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'coder:templates.build';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'coder:templates.author';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'coder:apikeys.manage_self';